Mobile Devices

Mobile devices generally consist of cell phones, tablets, and similar portable technology that we normally carry with us. These devices are designed for surveillance from the ground up, since they normally include cameras, wireless connectivity, and a restricted software stack that makes it difficult to install ad blockers and improve privacy settings.

The Advertising ID, Revisited

Recall from the section on Internet Tracking that mobile browsers have access to an advertising identifier that can function as a type of zombie cookie. This identifier, which is also called a mobile advertising ID (MAID), is actually worse than a zombie cookie. Every installed app on the device has access to this identifier, not just the browser. These apps often contain tracking code, and they have more privileged access to location data than does a website in the mobile browser. Consequently, services like Babel Street’s Locate X allow a phone to be geographically tracked using only the MAID.¹ Since the phone is tied to an individual, any person can be tracked if the advertising identifier of their device is known.

Since Locate X is available to just about anyone willing to pay for access, this service can be used for the targeted tracking of an individual. Furthermore, nothing stops law enforcement agencies from purchasing access to this service and tracking an individual without first needing to obtain a warrant.² Since a person who is using an Android or iOS device that contains a MAID has voluntarily consented to the commercial use of their data, and the privacy policies of the various apps give voluntary consent to track users, there are likely no Fourth Amendment implications to police use of these data. This loophole is especially concerning for women, since the police could use information from period tracking apps, shopping apps, and Internet searches to identify pregnancies. Data from a service like Locate X could then associate pregnant women with the locations of out-of-state abortion clinics, allowing criminal charges to be brought in a woman’s home state if abortion is illegal there.³

Shopping Apps

Men are not immune to being tracked and having their locations and habits monitored through their phones. Retailers, in particular, are interested in tracking everyone inside their stores. They can make extra money by selling information about what sections of a store a person frequents, what kinds of products they purchase, and so forth. Since most people would likely find someone following them around a store to be a bit creepy, the retail industry has adopted a quiet approach in which they try to ease people into being tracked in-store. Their ploy is to convince people to install the retail store’s app on their phone in exchange for discounts provided exclusively through the app.⁴

Within the store, the retailer has two options for tracking a person’s movements. The first, and more precise, option is to use a Bluetooth beacon to connect the phone to transceivers placed throughout the store. Due to the relatively short range of Bluetooth signals, it is practical to hide transceivers in shelves and other places that allow more precise tracking. Bluetooth tracking requires the retailer’s app to be installed on the phone in order to work around system permissions that would otherwise prohibit it.⁵

The second way that a retail store can track a shopper’s phone uses WiFi signals. This approach is less accurate, but it does not require a person to have the store’s app installed. WiFi-enabled devices constantly sent out scanning messages, which WiFi access points in the store can monitor and triangulate to an approximate location. Location accuracy can be somewhat improved if the device maintains an active connection, so many stores will provide “free” WiFi for this purpose. Since not all devices randomize the Media Access Control (MAC) address that is assigned to the WiFi chip at manufacturing time, it is often possible to establish a persistent unique identifier from this address alone.⁶

Mitigation

In order to have effective mitigation from the threats posed by mobile devices, it is necessary to switch the device’s stock operating system from the manufacturer-supplied one to an open-source, third party distribution. In practice, this type of mitigation is only possible on Android devices, and even then only on those phones and tablets where the bootloader can be unlocked to install something like GrapheneOS⁷ or LineageOS.⁸ Google Play Services (and Google apps) must not be installed, except perhaps by using a work profile on GrapheneOS, which can run Play Services inside an unprivileged sandbox.⁹

If it isn’t possible or feasible to purchase a mobile device capable of running a third-party Android distribution, then the next best mitigation approach is to avoid installing apps on factory Android or iOS devices. Each installed app increases the privacy (and security) attack surface, since each app includes its own library of surveillance features. Fully open-source apps that usually do not contain tracking capabilities are available for Android devices via alternative app stores like F-Droid.¹⁰ At the very least, mitigating privacy threats on mobile devices requires some behavioral changes. Do not use social media of any kind from a mobile device, and do not use your phone to look at porn. Instead, use a laptop or desktop computer with a browser configured for privacy.

Notes and References

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.